TODO Derivations can specify the new special attribute allowedRequisites, which has a similar meaning to allowedReferences. But instead of only enforcing to explicitly specify the immediate references, it requires the derivation to specify all the dependencies recursively (hence the name, requisites) that are used by the resulting output.

In addition to the usual bug fixes, this release has the following new features: Antiquotation is now allowed inside of quoted attribute names (e.g. set."${foo}"). In the case where the attribute name is just a single antiquotation, the quotes can be dropped (e.g. the above example can be written set.${foo}). If an attribute name inside of a set declaration evaluates to null (e.g. { ${null} = false; }), then that attribute is not added to the set. Experimental support for cryptographically signed binary caches. See the commit for details. An experimental new substituter, download-via-ssh, that fetches binaries from remote machines via SSH. Specifying the flags --option use-ssh-substituter true --option ssh-substituter-hosts user@hostname will cause Nix to download binaries from the specified machine, if it has them. nix-store -r and nix-build have a new flag, --check, that builds a previously built derivation again, and prints an error message if the output is not exactly the same. This helps to verify whether a derivation is truly deterministic. For example: $ nix-build '<nixpkgs>' -A patchelf … $ nix-build '<nixpkgs>' -A patchelf --check … error: derivation `/nix/store/1ipvxs…-patchelf-0.6' may not be deterministic: hash mismatch in output `/nix/store/4pc1dm…-patchelf-0.6.drv' The nix-instantiate flags --eval-only and --parse-only have been renamed to --eval and --parse, respectively. nix-instantiate, nix-build and nix-shell now have a flag --expr (or -E) that allows you to specify the expression to be evaluated as a command line argument. For instance, nix-instantiate --eval -E '1 + 2' will print 3. nix-shell improvements: It has a new flag, --packages (or -p), that sets up a build environment containing the specified packages from Nixpkgs. For example, the command $ nix-shell -p sqlite xorg.libX11 hello will start a shell in which the given packages are present. It now uses shell.nix as the default expression, falling back to default.nix if the former doesn’t exist. This makes it convenient to have a shell.nix in your project to set up a nice development environment. It evaluates the derivation attribute shellHook, if set. Since stdenv does not normally execute this hook, it allows you to do nix-shell-specific setup. It preserves the user’s timezone setting. In chroots, Nix now sets up a /dev containing only a minimal set of devices (such as /dev/null). Note that it only does this if you don’t have /dev listed in your build-chroot-dirs setting; otherwise, it will bind-mount the /dev from outside the chroot. Similarly, if you don’t have /dev/pts listed in build-chroot-dirs, Nix will mount a private devpts filesystem on the chroot’s /dev/pts. New built-in function: builtins.toJSON, which returns a JSON representation of a value. nix-env -q has a new flag --json to print a JSON representation of the installed or available packages. nix-env now supports meta attributes with more complex values, such as attribute sets. The -A flag now allows attribute names with dots in them, e.g. $ nix-instantiate --eval '<nixos>' -A 'config.systemd.units."nscd.service".text' The --max-freed option to nix-store --gc now accepts a unit specifier. For example, nix-store --gc --max-freed 1G will free up to 1 gigabyte of disk space. nix-collect-garbage has a new flag --delete-older-than Nd, which deletes all user environment generations older than N days. Likewise, nix-env --delete-generations accepts a Nd age limit. Nix now heuristically detects whether a build failure was due to a disk-full condition. In that case, the build is not flagged as “permanently failed”. This is mostly useful for Hydra, which needs to distinguish between permanent and transient build failures. There is a new symbol __curPos that expands to an attribute set containing its file name and line and column numbers, e.g. { file = "foo.nix"; line = 10; column = 5; }. There also is a new builtin function, unsafeGetAttrPos, that returns the position of an attribute. This is used by Nixpkgs to provide location information in error messages, e.g. $ nix-build '<nixpkgs>' -A libreoffice --argstr system x86_64-darwin error: the package ‘libreoffice-4.0.5.2’ in ‘.../applications/office/libreoffice/default.nix:263’ is not supported on ‘x86_64-darwin’ The garbage collector is now more concurrent with other Nix processes because it releases certain locks earlier. The binary tarball installer has been improved. You can now install Nix by running: $ bash <(curl https://nixos.org/nix/install) More evaluation errors include position information. For instance, selecting a missing attribute will print something like error: attribute `nixUnstabl' missing, at /etc/nixos/configurations/misc/eelco/mandark.nix:216:15 The command nix-setuid-helper is gone. Nix no longer uses Automake, but instead has a non-recursive, GNU Make-based build system. All installed libraries now have the prefix libnix. In particular, this gets rid of libutil, which could clash with libraries with the same name from other packages. Nix now requires a compiler that supports C++11. This release has contributions from Danny Wilson, Domen Kožar, Eelco Dolstra, Ian-Woo Kim, Ludovic Courtès, Maxim Ivanov, Petr Rockai, Ricardo M. Correia and Shea Levy.

This is primarily a bug fix release. Changes of interest are: Nix 1.6 accidentally changed the semantics of antiquoted paths in strings, such as "${/foo}/bar". This release reverts to the Nix 1.5.3 behaviour. Previously, Nix optimised expressions such as "${expr}" to expr. Thus it neither checked whether expr could be coerced to a string, nor applied such coercions. This meant that "${123}" evaluatued to 123, and "${./foo}" evaluated to ./foo (even though "${./foo} " evaluates to "/nix/store/hash-foo "). Nix now checks the type of antiquoted expressions and applies coercions. Nix now shows the exact position of undefined variables. In particular, undefined variable errors in a with previously didn't show any position information, so this makes it a lot easier to fix such errors. Undefined variables are now treated consistently. Previously, the tryEval function would catch undefined variables inside a with but not outside. Now tryEval never catches undefined variables. Bash completion in nix-shell now works correctly. Stack traces are less verbose: they no longer show calls to builtin functions and only show a single line for each derivation on the call stack. New built-in function: builtins.typeOf, which returns the type of its argument as a string.

In addition to the usual bug fixes, this release has several new features: The command nix-build --run-env has been renamed to nix-shell. nix-shell now sources $stdenv/setup inside the interactive shell, rather than in a parent shell. This ensures that shell functions defined by stdenv can be used in the interactive shell. nix-shell has a new flag --pure to clear the environment, so you get an environment that more closely corresponds to the “real” Nix build. nix-shell now sets the shell prompt (PS1) to ensure that Nix shells are distinguishable from your regular shells. nix-env no longer requires a * argument to match all packages, so nix-env -qa is equivalent to nix-env -qa '*'. nix-env -i has a new flag --remove-all (-r) to remove all previous packages from the profile. This makes it easier to do declarative package management similar to NixOS’s environment.systemPackages. For instance, if you have a specification my-packages.nix like this: with import <nixpkgs> {}; [ thunderbird geeqie ... ] then after any change to this file, you can run: $ nix-env -f my-packages.nix -ir to update your profile to match the specification. The ‘with’ language construct is now more lazy. It only evaluates its argument if a variable might actually refer to an attribute in the argument. For instance, this now works: let pkgs = with pkgs; { foo = "old"; bar = foo; } // overrides; overrides = { foo = "new"; }; in pkgs.bar This evaluates to "new", while previously it gave an “infinite recursion” error. Nix now has proper integer arithmetic operators. For instance, you can write x + y instead of builtins.add x y, or x < y instead of builtins.lessThan x y. The comparison operators also work on strings. On 64-bit systems, Nix integers are now 64 bits rather than 32 bits. When using the Nix daemon, the nix-daemon worker process now runs on the same CPU as the client, on systems that support setting CPU affinity. This gives a significant speedup on some systems. If a stack overflow occurs in the Nix evaluator, you now get a proper error message (rather than “Segmentation fault”) on some systems. In addition to directories, you can now bind-mount regular files in chroots through the (now misnamed) option build-chroot-dirs. This release has contributions from Domen Kožar, Eelco Dolstra, Florian Friesdorf, Gergely Risko, Ivan Kozik, Ludovic Courtès and Shea Levy.

This is primarily a bug fix release. The following changes are noteworthy: Yet another security bug involving hard links to files outside the store was fixed. This bug only affected multi-user installations that do not have hard link restrictions enabled. (NixOS is thus not vulnerable.) The default binary cache URL has changed from http://nixos.org/binary-cache to http://cache.nixos.org. The latter is hosted on Amazon CloudFront (courtesy of LogicBlox) and should provide better performance for users in both Europe and North America. The binary cache substituter now prints a warning message if fetching information from the cache takes more than five seconds. Thus network or server problems no longer make Nix appear to just hang. Stack traces now show function names, e.g. while evaluating `concatMapStrings' at `.../nixpkgs/pkgs/lib/strings.nix:18:25': Also, if a function is called with an unexpected argument, Nix now shows the name of the argument.

This is primarily a bug fix release. It has contributions from Eelco Dolstra, Lluís Batlle i Rossell and Shea Levy.

The bug fix to the bug fix had a bug itself, of course. But this time it will work for sure!

This is a brown paper bag release to fix a regression introduced by the hard link security fix in 1.4.

This release fixes a security bug in multi-user operation. It was possible for derivations to cause the mode of files outside of the Nix store to be changed to 444 (read-only but world-readable) by creating hard links to those files (details). There are also the following improvements: New built-in function: builtins.hashString. Build logs are now stored in /nix/var/log/nix/drvs/XX/, where XX is the first two characters of the derivation. This is useful on machines that keep a lot of build logs (such as Hydra servers). The function corepkgs/fetchurl can now make the downloaded file executable. This will allow getting rid of all bootstrap binaries in the Nixpkgs source tree. Language change: The expression "${./path} ..." now evaluates to a string instead of a path.

This is primarily a bug fix release. When this version is first run on Linux, it removes any immutable bits from the Nix store and increases the schema version of the Nix store. (The previous release removed support for setting the immutable bit; this release clears any remaining immutable bits to make certain operations more efficient.) This release has contributions from Eelco Dolstra and Stuart Pernsteiner.

This release has the following improvements and changes: Nix has a new binary substituter mechanism: the binary cache. A binary cache contains pre-built binaries of Nix packages. Whenever Nix wants to build a missing Nix store path, it will check a set of binary caches to see if any of them has a pre-built binary of that path. The configuration setting binary-caches contains a list of URLs of binary caches. For instance, doing $ nix-env -i thunderbird --option binary-caches http://cache.nixos.org will install Thunderbird and its dependencies, using the available pre-built binaries in http://cache.nixos.org. The main advantage over the old “manifest”-based method of getting pre-built binaries is that you don’t have to worry about your manifest being in sync with the Nix expressions you’re installing from; i.e., you don’t need to run nix-pull to update your manifest. It’s also more scalable because you don’t need to redownload a giant manifest file every time. A Nix channel can provide a binary cache URL that will be used automatically if you subscribe to that channel. If you use the Nixpkgs or NixOS channels (http://nixos.org/channels) you automatically get the cache http://cache.nixos.org. Binary caches are created using nix-push. For details on the operation and format of binary caches, see the nix-push manpage. More details are provided in this nix-dev posting. Multiple output support should now be usable. A derivation can declare that it wants to produce multiple store paths by saying something like outputs = [ "lib" "headers" "doc" ]; This will cause Nix to pass the intended store path of each output to the builder through the environment variables lib, headers and doc. Other packages can refer to a specific output by referring to pkg.output, e.g. buildInputs = [ pkg.lib pkg.headers ]; If you install a package with multiple outputs using nix-env, each output path will be symlinked into the user environment. Dashes are now valid as part of identifiers and attribute names. The new operation nix-store --repair-path allows corrupted or missing store paths to be repaired by redownloading them. nix-store --verify --check-contents --repair will scan and repair all paths in the Nix store. Similarly, nix-env, nix-build, nix-instantiate and nix-store --realise have a --repair flag to detect and fix bad paths by rebuilding or redownloading them. Nix no longer sets the immutable bit on files in the Nix store. Instead, the recommended way to guard the Nix store against accidental modification on Linux is to make it a read-only bind mount, like this: $ mount --bind /nix/store /nix/store $ mount -o remount,ro,bind /nix/store Nix will automatically make /nix/store writable as needed (using a private mount namespace) to allow modifications. Store optimisation (replacing identical files in the store with hard links) can now be done automatically every time a path is added to the store. This is enabled by setting the configuration option auto-optimise-store to true (disabled by default). Nix now supports xz compression for NARs in addition to bzip2. It compresses about 30% better on typical archives and decompresses about twice as fast. Basic Nix expression evaluation profiling: setting the environment variable NIX_COUNT_CALLS to 1 will cause Nix to print how many times each primop or function was executed. New primops: concatLists, elem, elemAt and filter. The command nix-copy-closure has a new flag --use-substitutes (-s) to download missing paths on the target machine using the substitute mechanism. The command nix-worker has been renamed to nix-daemon. Support for running the Nix worker in “slave” mode has been removed. The --help flag of every Nix command now invokes man. Chroot builds are now supported on systemd machines. This release has contributions from Eelco Dolstra, Florian Friesdorf, Mats Erik Andersson and Shea Levy.

This release has the following improvements: On Linux, when doing a chroot build, Nix now uses various namespace features provided by the Linux kernel to improve build isolation. Namely: The private network namespace ensures that builders cannot talk to the outside world (or vice versa): each build only sees a private loopback interface. This also means that two concurrent builds can listen on the same port (e.g. as part of a test) without conflicting with each other. The PID namespace causes each build to start as PID 1. Processes outside of the chroot are not visible to those on the inside. On the other hand, processes inside the chroot are visible from the outside (though with different PIDs). The IPC namespace prevents the builder from communicating with outside processes using SysV IPC mechanisms (shared memory, message queues, semaphores). It also ensures that all IPC objects are destroyed when the builder exits. The UTS namespace ensures that builders see a hostname of localhost rather than the actual hostname. The private mount namespace was already used by Nix to ensure that the bind-mounts used to set up the chroot are cleaned up automatically. Build logs are now compressed using bzip2. The command nix-store -l decompresses them on the fly. This can be disabled by setting the option build-compress-log to false. The creation of build logs in /nix/var/log/nix/drvs can be disabled by setting the new option build-keep-log to false. This is useful, for instance, for Hydra build machines. Nix now reserves some space in /nix/var/nix/db/reserved to ensure that the garbage collector can run successfully if the disk is full. This is necessary because SQLite transactions fail if the disk is full. Added a basic fetchurl function. This is not intended to replace the fetchurl in Nixpkgs, but is useful for bootstrapping; e.g., it will allow us to get rid of the bootstrap binaries in the Nixpkgs source tree and download them instead. You can use it by doing import <nix/fetchurl.nix> { url = url; sha256 = "hash"; }. (Shea Levy) Improved RPM spec file. (Michel Alexandre Salim) Support for on-demand socket-based activation in the Nix daemon with systemd. Added a manpage for nix.conf5. When using the Nix daemon, the -s flag in nix-env -qa is now much faster.

There have been numerous improvements and bug fixes since the previous release. Here are the most significant: Nix can now optionally use the Boehm garbage collector. This significantly reduces the Nix evaluator’s memory footprint, especially when evaluating large NixOS system configurations. It can be enabled using the --enable-gc configure option. Nix now uses SQLite for its database. This is faster and more flexible than the old ad hoc format. SQLite is also used to cache the manifests in /nix/var/nix/manifests, resulting in a significant speedup. Nix now has an search path for expressions. The search path is set using the environment variable NIX_PATH and the -I command line option. In Nix expressions, paths between angle brackets are used to specify files that must be looked up in the search path. For instance, the expression <nixpkgs/default.nix> looks for a file nixpkgs/default.nix relative to every element in the search path. The new command nix-build --run-env builds all dependencies of a derivation, then starts a shell in an environment containing all variables from the derivation. This is useful for reproducing the environment of a derivation for development. The new command nix-store --verify-path verifies that the contents of a store path have not changed. The new command nix-store --print-env prints out the environment of a derivation in a format that can be evaluated by a shell. Attribute names can now be arbitrary strings. For instance, you can write { "foo-1.2" = …; "bla bla" = …; }."bla bla". Attribute selection can now provide a default value using the or operator. For instance, the expression x.y.z or e evaluates to the attribute x.y.z if it exists, and e otherwise. The right-hand side of the ? operator can now be an attribute path, e.g., attrs ? a.b.c. On Linux, Nix will now make files in the Nix store immutable on filesystems that support it. This prevents accidental modification of files in the store by the root user. Nix has preliminary support for derivations with multiple outputs. This is useful because it allows parts of a package to be deployed and garbage-collected separately. For instance, development parts of a package such as header files or static libraries would typically not be part of the closure of an application, resulting in reduced disk usage and installation time. The Nix store garbage collector is faster and holds the global lock for a shorter amount of time. The option --timeout (corresponding to the configuration setting build-timeout) allows you to set an absolute timeout on builds — if a build runs for more than the given number of seconds, it is terminated. This is useful for recovering automatically from builds that are stuck in an infinite loop but keep producing output, and for which --max-silent-time is ineffective. Nix development has moved to GitHub ().

This release has the following improvements: The Nix expression evaluator is now much faster in most cases: typically, 3 to 8 times compared to the old implementation. It also uses less memory. It no longer depends on the ATerm library. Support for configurable parallelism inside builders. Build scripts have always had the ability to perform multiple build actions in parallel (for instance, by running make -j 2), but this was not desirable because the number of actions to be performed in parallel was not configurable. Nix now has an option --cores N as well as a configuration setting build-cores = N that causes the environment variable NIX_BUILD_CORES to be set to N when the builder is invoked. The builder can use this at its discretion to perform a parallel build, e.g., by calling make -j N. In Nixpkgs, this can be enabled on a per-package basis by setting the derivation attribute enableParallelBuilding to true. nix-store -q now supports XML output through the --xml flag. Several bug fixes.

This is a bug-fix release. Among other things, it fixes building on Mac OS X (Snow Leopard), and improves the contents of /etc/passwd and /etc/group in chroot builds.

This release has the following improvements: The garbage collector now starts deleting garbage much faster than before. It no longer determines liveness of all paths in the store, but does so on demand. Added a new operation, nix-store --query --roots, that shows the garbage collector roots that directly or indirectly point to the given store paths. Removed support for converting Berkeley DB-based Nix databases to the new schema. Removed the --use-atime and --max-atime garbage collector options. They were not very useful in practice. On Windows, Nix now requires Cygwin 1.7.x. A few bug fixes.

This is primarily a bug fix release. It has some new features: Syntactic sugar for writing nested attribute sets. Instead of { foo = { bar = 123; xyzzy = true; }; a = { b = { c = "d"; }; }; } you can write { foo.bar = 123; foo.xyzzy = true; a.b.c = "d"; } This is useful, for instance, in NixOS configuration files. Support for Nix channels generated by Hydra, the Nix-based continuous build system. (Hydra generates NAR archives on the fly, so the size and hash of these archives isn’t known in advance.) Support i686-linux builds directly on x86_64-linux Nix installations. This is implemented using the personality() syscall, which causes uname to return i686 in child processes. Various improvements to the chroot support. Building in a chroot works quite well now. Nix no longer blocks if it tries to build a path and another process is already building the same path. Instead it tries to build another buildable path first. This improves parallelism. Support for large (> 4 GiB) files in NAR archives. Various (performance) improvements to the remote build mechanism. New primops: builtins.addErrorContext (to add a string to stack traces — useful for debugging), builtins.isBool, builtins.isString, builtins.isInt, builtins.intersectAttrs. OpenSolaris support (Sander van der Burg). Stack traces are no longer displayed unless the --show-trace option is used. The scoping rules for inherit (e) ... in recursive attribute sets have changed. The expression e can now refer to the attributes defined in the containing set.

Nix no longer uses Berkeley DB to store Nix store metadata. The principal advantages of the new storage scheme are: it works properly over decent implementations of NFS (allowing Nix stores to be shared between multiple machines); no recovery is needed when a Nix process crashes; no write access is needed for read-only operations; no more running out of Berkeley DB locks on certain operations. You still need to compile Nix with Berkeley DB support if you want Nix to automatically convert your old Nix store to the new schema. If you don’t need this, you can build Nix with the configure option --disable-old-db-compat. After the automatic conversion to the new schema, you can delete the old Berkeley DB files: $ cd /nix/var/nix/db $ rm __db* log.* derivers references referrers reserved validpaths DB_CONFIG The new metadata is stored in the directories /nix/var/nix/db/info and /nix/var/nix/db/referrer. Though the metadata is stored in human-readable plain-text files, they are not intended to be human-editable, as Nix is rather strict about the format. The new storage schema may or may not require less disk space than the Berkeley DB environment, mostly depending on the cluster size of your file system. With 1 KiB clusters (which seems to be the ext3 default nowadays) it usually takes up much less space. There is a new substituter that copies paths directly from other (remote) Nix stores mounted somewhere in the filesystem. For instance, you can speed up an installation by mounting some remote Nix store that already has the packages in question via NFS or sshfs. The environment variable NIX_OTHER_STORES specifies the locations of the remote Nix directories, e.g. /mnt/remote-fs/nix. New nix-store operations --dump-db and --load-db to dump and reload the Nix database. The garbage collector has a number of new options to allow only some of the garbage to be deleted. The option --max-freed N tells the collector to stop after at least N bytes have been deleted. The option --max-links N tells it to stop after the link count on /nix/store has dropped below N. This is useful for very large Nix stores on filesystems with a 32000 subdirectories limit (like ext3). The option --use-atime causes store paths to be deleted in order of ascending last access time. This allows non-recently used stuff to be deleted. The option --max-atime time specifies an upper limit to the last accessed time of paths that may be deleted. For instance, $ nix-store --gc -v --max-atime $(date +%s -d "2 months ago") deletes everything that hasn’t been accessed in two months. nix-env now uses optimistic profile locking when performing an operation like installing or upgrading, instead of setting an exclusive lock on the profile. This allows multiple nix-env -i / -u / -e operations on the same profile in parallel. If a nix-env operation sees at the end that the profile was changed in the meantime by another process, it will just restart. This is generally cheap because the build results are still in the Nix store. The option --dry-run is now supported by nix-store -r and nix-build. The information previously shown by --dry-run (i.e., which derivations will be built and which paths will be substituted) is now always shown by nix-env, nix-store -r and nix-build. The total download size of substitutable paths is now also shown. For instance, a build will show something like the following derivations will be built: /nix/store/129sbxnk5n466zg6r1qmq1xjv9zymyy7-activate-configuration.sh.drv /nix/store/7mzy971rdm8l566ch8hgxaf89x7lr7ik-upstart-jobs.drv ... the following paths will be downloaded/copied (30.02 MiB): /nix/store/4m8pvgy2dcjgppf5b4cj5l6wyshjhalj-samba-3.2.4 /nix/store/7h1kwcj29ip8vk26rhmx6bfjraxp0g4l-libunwind-0.98.6 ... Language features: @-patterns as in Haskell. For instance, in a function definition f = args @ {x, y, z}: ...; args refers to the argument as a whole, which is further pattern-matched against the attribute set pattern {x, y, z}. “...” (ellipsis) patterns. An attribute set pattern can now say ... at the end of the attribute name list to specify that the function takes at least the listed attributes, while ignoring additional attributes. For instance, {stdenv, fetchurl, fuse, ...}: ... defines a function that accepts any attribute set that includes at least the three listed attributes. New primops: builtins.parseDrvName (split a package name string like "nix-0.12pre12876" into its name and version components, e.g. "nix" and "0.12pre12876"), builtins.compareVersions (compare two version strings using the same algorithm that nix-env uses), builtins.length (efficiently compute the length of a list), builtins.mul (integer multiplication), builtins.div (integer division). nix-prefetch-url now supports mirror:// URLs, provided that the environment variable NIXPKGS_ALL points at a Nixpkgs tree. Removed the commands nix-pack-closure and nix-unpack-closure. You can do almost the same thing but much more efficiently by doing nix-store --export $(nix-store -qR paths) > closure and nix-store --import < closure. Lots of bug fixes, including a big performance bug in the handling of with-expressions.

Nix 0.11 has many improvements over the previous stable release. The most important improvement is secure multi-user support. It also features many usability enhancements and language extensions, many of them prompted by NixOS, the purely functional Linux distribution based on Nix. Here is an (incomplete) list: Secure multi-user support. A single Nix store can now be shared between multiple (possible untrusted) users. This is an important feature for NixOS, where it allows non-root users to install software. The old setuid method for sharing a store between multiple users has been removed. Details for setting up a multi-user store can be found in the manual. The new command nix-copy-closure gives you an easy and efficient way to exchange software between machines. It copies the missing parts of the closure of a set of store path to or from a remote machine via ssh. A new kind of string literal: strings between double single-quotes ('') have indentation “intelligently” removed. This allows large strings (such as shell scripts or configuration file fragments in NixOS) to cleanly follow the indentation of the surrounding expression. It also requires much less escaping, since '' is less common in most languages than ". nix-env --set modifies the current generation of a profile so that it contains exactly the specified derivation, and nothing else. For example, nix-env -p /nix/var/nix/profiles/browser --set firefox lets the profile named browser contain just Firefox. nix-env now maintains meta-information about installed packages in profiles. The meta-information is the contents of the meta attribute of derivations, such as description or homepage. The command nix-env -q --xml --meta shows all meta-information. nix-env now uses the meta.priority attribute of derivations to resolve filename collisions between packages. Lower priority values denote a higher priority. For instance, the GCC wrapper package and the Binutils package in Nixpkgs both have a file bin/ld, so previously if you tried to install both you would get a collision. Now, on the other hand, the GCC wrapper declares a higher priority than Binutils, so the former’s bin/ld is symlinked in the user environment. nix-env -i / -u: instead of breaking package ties by version, break them by priority and version number. That is, if there are multiple packages with the same name, then pick the package with the highest priority, and only use the version if there are multiple packages with the same priority. This makes it possible to mark specific versions/variant in Nixpkgs more or less desirable than others. A typical example would be a beta version of some package (e.g., gcc-4.2.0rc1) which should not be installed even though it is the highest version, except when it is explicitly selected (e.g., nix-env -i gcc-4.2.0rc1). nix-env --set-flag allows meta attributes of installed packages to be modified. There are several attributes that can be usefully modified, because they affect the behaviour of nix-env or the user environment build script: meta.priority can be changed to resolve filename clashes (see above). meta.keep can be set to true to prevent the package from being upgraded or replaced. Useful if you want to hang on to an older version of a package. meta.active can be set to false to “disable” the package. That is, no symlinks will be generated to the files of the package, but it remains part of the profile (so it won’t be garbage-collected). Set it back to true to re-enable the package. nix-env -q now has a flag --prebuilt-only (-b) that causes nix-env to show only those derivations whose output is already in the Nix store or that can be substituted (i.e., downloaded from somewhere). In other words, it shows the packages that can be installed “quickly”, i.e., don’t need to be built from source. The -b flag is also available in nix-env -i and nix-env -u to filter out derivations for which no pre-built binary is available. The new option --argstr (in nix-env, nix-instantiate and nix-build) is like --arg, except that the value is a string. For example, --argstr system i686-linux is equivalent to --arg system \"i686-linux\" (note that --argstr prevents annoying quoting around shell arguments). nix-store has a new operation --read-log (-l) paths that shows the build log of the given paths. Nix now uses Berkeley DB 4.5. The database is upgraded automatically, but you should be careful not to use old versions of Nix that still use Berkeley DB 4.4. The option --max-silent-time (corresponding to the configuration setting build-max-silent-time) allows you to set a timeout on builds — if a build produces no output on stdout or stderr for the given number of seconds, it is terminated. This is useful for recovering automatically from builds that are stuck in an infinite loop. nix-channel: each subscribed channel is its own attribute in the top-level expression generated for the channel. This allows disambiguation (e.g. nix-env -i -A nixpkgs_unstable.firefox). The substitutes table has been removed from the database. This makes operations such as nix-pull and nix-channel --update much, much faster. nix-pull now supports bzip2-compressed manifests. This speeds up channels. nix-prefetch-url now has a limited form of caching. This is used by nix-channel to prevent unnecessary downloads when the channel hasn’t changed. nix-prefetch-url now by default computes the SHA-256 hash of the file instead of the MD5 hash. In calls to fetchurl you should pass the sha256 attribute instead of md5. You can pass either a hexadecimal or a base-32 encoding of the hash. Nix can now perform builds in an automatically generated “chroot”. This prevents a builder from accessing stuff outside of the Nix store, and thus helps ensure purity. This is an experimental feature. The new command nix-store --optimise reduces Nix store disk space usage by finding identical files in the store and hard-linking them to each other. It typically reduces the size of the store by something like 25-35%. ~/.nix-defexpr can now be a directory, in which case the Nix expressions in that directory are combined into an attribute set, with the file names used as the names of the attributes. The command nix-env --import (which set the ~/.nix-defexpr symlink) is removed. Derivations can specify the new special attribute allowedReferences to enforce that the references in the output of a derivation are a subset of a declared set of paths. For example, if allowedReferences is an empty list, then the output must not have any references. This is used in NixOS to check that generated files such as initial ramdisks for booting Linux don’t have any dependencies. The new attribute exportReferencesGraph allows builders access to the references graph of their inputs. This is used in NixOS for tasks such as generating ISO-9660 images that contain a Nix store populated with the closure of certain paths. Fixed-output derivations (like fetchurl) can define the attribute impureEnvVars to allow external environment variables to be passed to builders. This is used in Nixpkgs to support proxy configuration, among other things. Several new built-in functions: builtins.attrNames, builtins.filterSource, builtins.isAttrs, builtins.isFunction, builtins.listToAttrs, builtins.stringLength, builtins.sub, builtins.substring, throw, builtins.trace, builtins.readFile.

This release fixes two somewhat obscure bugs that occur when evaluating Nix expressions that are stored inside the Nix store (NIX-67). These do not affect most users.

This version of Nix uses Berkeley DB 4.4 instead of 4.3. The database is upgraded automatically, but you should be careful not to use old versions of Nix that still use Berkeley DB 4.3. In particular, if you use a Nix installed through Nix, you should run $ nix-store --clear-substitutes first. Also, the database schema has changed slighted to fix a performance issue (see below). When you run any Nix 0.10 command for the first time, the database will be upgraded automatically. This is irreversible. nix-env usability improvements: An option --compare-versions (or -c) has been added to nix-env --query to allow you to compare installed versions of packages to available versions, or vice versa. An easy way to see if you are up to date with what’s in your subscribed channels is nix-env -qc \*. nix-env --query now takes as arguments a list of package names about which to show information, just like --install, etc.: for example, nix-env -q gcc. Note that to show all derivations, you need to specify \*. nix-env -i pkgname will now install the highest available version of pkgname, rather than installing all available versions (which would probably give collisions) (NIX-31). nix-env (-i|-u) --dry-run now shows exactly which missing paths will be built or substituted. nix-env -qa --description shows human-readable descriptions of packages, provided that they have a meta.description attribute (which most packages in Nixpkgs don’t have yet). New language features: Reference scanning (which happens after each build) is much faster and takes a constant amount of memory. String interpolation. Expressions like "--with-freetype2-library=" + freetype + "/lib" can now be written as "--with-freetype2-library=${freetype}/lib" You can write arbitrary expressions within ${...}, not just identifiers. Multi-line string literals. String concatenations can now involve derivations, as in the example "--with-freetype2-library=" + freetype + "/lib". This was not previously possible because we need to register that a derivation that uses such a string is dependent on freetype. The evaluator now properly propagates this information. Consequently, the subpath operator (~) has been deprecated. Default values of function arguments can now refer to other function arguments; that is, all arguments are in scope in the default values (NIX-45). Lots of new built-in primitives, such as functions for list manipulation and integer arithmetic. See the manual for a complete list. All primops are now available in the set builtins, allowing one to test for the availability of primop in a backwards-compatible way. Real let-expressions: let x = ...; ... z = ...; in .... New commands nix-pack-closure and nix-unpack-closure than can be used to easily transfer a store path with all its dependencies to another machine. Very convenient whenever you have some package on your machine and you want to copy it somewhere else. XML support: nix-env -q --xml prints the installed or available packages in an XML representation for easy processing by other tools. nix-instantiate --eval-only --xml prints an XML representation of the resulting term. (The new flag --strict forces ‘deep’ evaluation of the result, i.e., list elements and attributes are evaluated recursively.) In Nix expressions, the primop builtins.toXML converts a term to an XML representation. This is primarily useful for passing structured information to builders. You can now unambiguously specify which derivation to build or install in nix-env, nix-instantiate and nix-build using the --attr / -A flags, which takes an attribute name as argument. (Unlike symbolic package names such as subversion-1.4.0, attribute names in an attribute set are unique.) For instance, a quick way to perform a test build of a package in Nixpkgs is nix-build pkgs/top-level/all-packages.nix -A foo. nix-env -q --attr shows the attribute names corresponding to each derivation. If the top-level Nix expression used by nix-env, nix-instantiate or nix-build evaluates to a function whose arguments all have default values, the function will be called automatically. Also, the new command-line switch --arg name value can be used to specify function arguments on the command line. nix-install-package --url URL allows a package to be installed directly from the given URL. Nix now works behind an HTTP proxy server; just set the standard environment variables http_proxy, https_proxy, ftp_proxy or all_proxy appropriately. Functions such as fetchurl in Nixpkgs also respect these variables. nix-build -o symlink allows the symlink to the build result to be named something other than result. Platform support: Support for 64-bit platforms, provided a suitably patched ATerm library is used. Also, files larger than 2 GiB are now supported. Added support for Cygwin (Windows, i686-cygwin), Mac OS X on Intel (i686-darwin) and Linux on PowerPC (powerpc-linux). Users of SMP and multicore machines will appreciate that the number of builds to be performed in parallel can now be specified in the configuration file in the build-max-jobs setting. Garbage collector improvements: Open files (such as running programs) are now used as roots of the garbage collector. This prevents programs that have been uninstalled from being garbage collected while they are still running. The script that detects these additional runtime roots (find-runtime-roots.pl) is inherently system-specific, but it should work on Linux and on all platforms that have the lsof utility. nix-store --gc (a.k.a. nix-collect-garbage) prints out the number of bytes freed on standard output. nix-store --gc --print-dead shows how many bytes would be freed by an actual garbage collection. nix-collect-garbage -d removes all old generations of all profiles before calling the actual garbage collector (nix-store --gc). This is an easy way to get rid of all old packages in the Nix store. nix-store now has an operation --delete to delete specific paths from the Nix store. It won’t delete reachable (non-garbage) paths unless --ignore-liveness is specified. Berkeley DB 4.4’s process registry feature is used to recover from crashed Nix processes. A performance issue has been fixed with the referer table, which stores the inverse of the references table (i.e., it tells you what store paths refer to a given path). Maintaining this table could take a quadratic amount of time, as well as a quadratic amount of Berkeley DB log file space (in particular when running the garbage collector) (NIX-23). Nix now catches the TERM and HUP signals in addition to the INT signal. So you can now do a killall nix-store without triggering a database recovery. bsdiff updated to version 4.3. Substantial performance improvements in expression evaluation and nix-env -qa, all thanks to Valgrind. Memory use has been reduced by a factor 8 or so. Big speedup by memoisation of path hashing. Lots of bug fixes, notably: Make sure that the garbage collector can run successfully when the disk is full (NIX-18). nix-env now locks the profile to prevent races between concurrent nix-env operations on the same profile (NIX-7). Removed misleading messages from nix-env -i (e.g., installing `foo' followed by uninstalling `foo') (NIX-17). Nix source distributions are a lot smaller now since we no longer include a full copy of the Berkeley DB source distribution (but only the bits we need). Header files are now installed so that external programs can use the Nix libraries.

This bug fix release fixes two problems on Mac OS X: If Nix was linked against statically linked versions of the ATerm or Berkeley DB library, there would be dynamic link errors at runtime. nix-pull and nix-push intermittently failed due to race conditions involving pipes and child processes with error messages such as open2: open(GLOB(0x180b2e4), >&=9) failed: Bad file descriptor at /nix/bin/nix-pull line 77 (issue NIX-14).

This bug fix release addresses a problem with the ATerm library when the --with-aterm flag in configure was not used.

NOTE: this version of Nix uses Berkeley DB 4.3 instead of 4.2. The database is upgraded automatically, but you should be careful not to use old versions of Nix that still use Berkeley DB 4.2. In particular, if you use a Nix installed through Nix, you should run $ nix-store --clear-substitutes first. Unpacking of patch sequences is much faster now since we no longer do redundant unpacking and repacking of intermediate paths. Nix now uses Berkeley DB 4.3. The derivation primitive is lazier. Attributes of dependent derivations can mutually refer to each other (as long as there are no data dependencies on the outPath and drvPath attributes computed by derivation). For example, the expression derivation attrs now evaluates to (essentially) attrs // { type = "derivation"; outPath = derivation! attrs; drvPath = derivation! attrs; } where derivation! is a primop that does the actual derivation instantiation (i.e., it does what derivation used to do). The advantage is that it allows commands such as nix-env -qa and nix-env -i to be much faster since they no longer need to instantiate all derivations, just the name attribute. Also, it allows derivations to cyclically reference each other, for example, webServer = derivation { ... hostName = "svn.cs.uu.nl"; services = [svnService]; }; svnService = derivation { ... hostName = webServer.hostName; }; Previously, this would yield a black hole (infinite recursion). nix-build now defaults to using ./default.nix if no Nix expression is specified. nix-instantiate, when applied to a Nix expression that evaluates to a function, will call the function automatically if all its arguments have defaults. Nix now uses libtool to build dynamic libraries. This reduces the size of executables. A new list concatenation operator ++. For example, [1 2 3] ++ [4 5 6] evaluates to [1 2 3 4 5 6]. Some currently undocumented primops to support low-level build management using Nix (i.e., using Nix as a Make replacement). See the commit messages for r3578 and r3580. Various bug fixes and performance improvements.

This is a bug fix release. Patch downloading was broken. The garbage collector would not delete paths that had references from invalid (but substitutable) paths.

NOTE: the hashing scheme in Nix 0.8 changed (as detailed below). As a result, nix-pull manifests and channels built for Nix 0.7 and below will now work anymore. However, the Nix expression language has not changed, so you can still build from source. Also, existing user environments continue to work. Nix 0.8 will automatically upgrade the database schema of previous installations when it is first run. If you get the error message you have an old-style manifest `/nix/var/nix/manifests/[...]'; please delete it you should delete previously downloaded manifests: $ rm /nix/var/nix/manifests/* If nix-channel gives the error message manifest `http://catamaran.labs.cs.uu.nl/dist/nix/channels/[channel]/MANIFEST' is too old (i.e., for Nix <= 0.7) then you should unsubscribe from the offending channel (nix-channel --remove URL; leave out /MANIFEST), and subscribe to the same URL, with channels replaced by channels-v3 (e.g., ). Nix 0.8 has the following improvements: The cryptographic hashes used in store paths are now 160 bits long, but encoded in base-32 so that they are still only 32 characters long (e.g., /nix/store/csw87wag8bqlqk7ipllbwypb14xainap-atk-1.9.0). (This is actually a 160 bit truncation of a SHA-256 hash.) Big cleanups and simplifications of the basic store semantics. The notion of “closure store expressions” is gone (and so is the notion of “successors”); the file system references of a store path are now just stored in the database. For instance, given any store path, you can query its closure: $ nix-store -qR $(which firefox) ... lots of paths ... Also, Nix now remembers for each store path the derivation that built it (the “deriver”): $ nix-store -qR $(which firefox) /nix/store/4b0jx7vq80l9aqcnkszxhymsf1ffa5jd-firefox-1.0.1.drv So to see the build-time dependencies, you can do $ nix-store -qR $(nix-store -qd $(which firefox)) or, in a nicer format: $ nix-store -q --tree $(nix-store -qd $(which firefox)) File system references are also stored in reverse. For instance, you can query all paths that directly or indirectly use a certain Glibc: $ nix-store -q --referrers-closure \ /nix/store/8lz9yc6zgmc0vlqmn2ipcpkjlmbi51vv-glibc-2.3.4 The concept of fixed-output derivations has been formalised. Previously, functions such as fetchurl in Nixpkgs used a hack (namely, explicitly specifying a store path hash) to prevent changes to, say, the URL of the file from propagating upwards through the dependency graph, causing rebuilds of everything. This can now be done cleanly by specifying the outputHash and outputHashAlgo attributes. Nix itself checks that the content of the output has the specified hash. (This is important for maintaining certain invariants necessary for future work on secure shared stores.) One-click installation :-) It is now possible to install any top-level component in Nixpkgs directly, through the web — see, e.g., . All you have to do is associate /nix/bin/nix-install-package with the MIME type application/nix-package (or the extension .nixpkg), and clicking on a package link will cause it to be installed, with all appropriate dependencies. If you just want to install some specific application, this is easier than subscribing to a channel. nix-store -r PATHS now builds all the derivations PATHS in parallel. Previously it did them sequentially (though exploiting possible parallelism between subderivations). This is nice for build farms. nix-channel has new operations --list and --remove. New ways of installing components into user environments: Copy from another user environment: $ nix-env -i --from-profile .../other-profile firefox Install a store derivation directly (bypassing the Nix expression language entirely): $ nix-env -i /nix/store/z58v41v21xd3...-aterm-2.3.1.drv (This is used to implement nix-install-package, which is therefore immune to evolution in the Nix expression language.) Install an already built store path directly: $ nix-env -i /nix/store/hsyj5pbn0d9i...-aterm-2.3.1 Install the result of a Nix expression specified as a command-line argument: $ nix-env -f .../i686-linux.nix -i -E 'x: x.firefoxWrapper' The difference with the normal installation mode is that -E does not use the name attributes of derivations. Therefore, this can be used to disambiguate multiple derivations with the same name. A hash of the contents of a store path is now stored in the database after a successful build. This allows you to check whether store paths have been tampered with: nix-store --verify --check-contents. Implemented a concurrent garbage collector. It is now always safe to run the garbage collector, even if other Nix operations are happening simultaneously. However, there can still be GC races if you use nix-instantiate and nix-store --realise directly to build things. To prevent races, use the --add-root flag of those commands. The garbage collector now finally deletes paths in the right order (i.e., topologically sorted under the “references” relation), thus making it safe to interrupt the collector without risking a store that violates the closure invariant. Likewise, the substitute mechanism now downloads files in the right order, thus preserving the closure invariant at all times. The result of nix-build is now registered as a root of the garbage collector. If the ./result link is deleted, the GC root disappears automatically. The behaviour of the garbage collector can be changed globally by setting options in /nix/etc/nix/nix.conf. gc-keep-derivations specifies whether deriver links should be followed when searching for live paths. gc-keep-outputs specifies whether outputs of derivations should be followed when searching for live paths. env-keep-derivations specifies whether user environments should store the paths of derivations when they are added (thus keeping the derivations alive). New nix-env query flags --drv-path and --out-path. fetchurl allows SHA-1 and SHA-256 in addition to MD5. Just specify the attribute sha1 or sha256 instead of md5. Manual updates.

Binary patching. When upgrading components using pre-built binaries (through nix-pull / nix-channel), Nix can automatically download and apply binary patches to already installed components instead of full downloads. Patching is “smart”: if there is a sequence of patches to an installed component, Nix will use it. Patches are currently generated automatically between Nixpkgs (pre-)releases. Simplifications to the substitute mechanism. Nix-pull now stores downloaded manifests in /nix/var/nix/manifests. Metadata on files in the Nix store is canonicalised after builds: the last-modified timestamp is set to 0 (00:00:00 1/1/1970), the mode is set to 0444 or 0555 (readable and possibly executable by all; setuid/setgid bits are dropped), and the group is set to the default. This ensures that the result of a build and an installation through a substitute is the same; and that timestamp dependencies are revealed.

Rewrite of the normalisation engine. Multiple builds can now be performed in parallel (option -j). Distributed builds. Nix can now call a shell script to forward builds to Nix installations on remote machines, which may or may not be of the same platform type. Option --fallback allows recovery from broken substitutes. Option --keep-going causes building of other (unaffected) derivations to continue if one failed. Improvements to the garbage collector (i.e., it should actually work now). Setuid Nix installations allow a Nix store to be shared among multiple users. Substitute registration is much faster now. A utility nix-build to build a Nix expression and create a symlink to the result int the current directory; useful for testing Nix derivations. Manual updates. nix-env changes: Derivations for other platforms are filtered out (which can be overridden using --system-filter). --install by default now uninstall previous derivations with the same name. --upgrade allows upgrading to a specific version. New operation --delete-generations to remove profile generations (necessary for effective garbage collection). Nicer output (sorted, columnised). More sensible verbosity levels all around (builder output is now shown always, unless -Q is given). Nix expression language changes: New language construct: with E1; E2 brings all attributes defined in the attribute set E1 in scope in E2. Added a map function. Various new operators (e.g., string concatenation). Expression evaluation is much faster. An Emacs mode for editing Nix expressions (with syntax highlighting and indentation) has been added. Many bug fixes.

Please refer to the Subversion commit log messages.